AI Savings Evidence: Customer Privacy Notice

Version 1.1.0, effective 14 November 2026. This version updates the products covered and the current processors.

This notice explains how I use personal details when:

• you buy one of my digital template kits;

• you book a free 15-minute Executive Fit Call, or buy a Focused Diagnostic, an Assurance Review, a Recovery Sprint, Fractional advisory, or other work I supply under a written quote;

• you send me order or intake information, including through my enquiry form;

• you email me about a kit or an engagement; or

• you use a website I operate, including savingsevidence.com and aisavingscheck.com.

If I contacted you first about my services, my outreach privacy notice also applies; it is linked in my first message to you. If I contacted you through a newsletter or an enquiry form, the notice linked at that point also applies.

Your right to object

You can object at any time to my use of your details for direct marketing, and I will stop. This right is absolute. Reply STOP to any email from me, or email hello@aisavingscheck.com. You can also object to any other use of your details that relies on my legitimate interests.

Who I am

AI Savings Evidence is run by Dr Idris Maiga, a sole trader based in Northern Ireland, UK.

• Controller: Dr Idrissa Maiga, trading as Dr Idris Maiga, sole trader

• Contact about your data, including any rights request: hello@aisavingscheck.com. You can also reply to any email I have sent you.

• Location: Belfast, United Kingdom

I have not appointed a Data Protection Officer.

What I collect

Customers and buyers:

• the name, work email and organisation of the person ordering, and the billing address entered at checkout;

• the product bought, the price paid, the payment date, any invoice or purchase-order number, and refund records;

• the intake answers, documents and files your organisation sends me;

• our emails;

• for a call session: your name and email in the calendar invitation (and your phone number, if we agree to speak by phone), your image and voice during the call, and anything you choose to show on your shared screen. I do not record calls, take screenshots or keep copies of what you show. Please close or hide anything that names staff or other people before you share your screen. If something like that appears, I will ask you to close it and I will not note it. My follow-up email names no individuals.

Payment card details are collected and held by Stripe, not by me. I see only limited payment information, such as the last four digits of the card and the payment status. Card checkout is not open yet; until it opens, payments are by invoice or bank transfer and no card details are collected.

My reviews are designed to use aggregate data only. Please do not send names, staff IDs, salaries or other details of identifiable staff. If they arrive, I delete them unread.

I do not collect special category data, such as health, religion or political views.

Where I get it

From you, or from your organisation, when you order, complete the intake form or email me.

Why, and on what basis

• To take and deliver your order, handle revisions and refunds, and send receipts and invoices: to perform our contract, or to take steps you ask for before we agree one (UK GDPR Article 6(1)(b)). Where the buyer is an organisation, this is my legitimate interest in dealing with its staff (Article 6(1)(f)).

• To keep accounting and tax records: a legal obligation (Article 6(1)(c)).

• To answer your enquiries: my legitimate interest in responding to people who contact me (Article 6(1)(f)).

• To tell existing customers about similar services: my legitimate interests. You can opt out in every email.

• To keep a do-not-contact list, so that anyone who opts out is never contacted again: my legitimate interests and my legal duty to respect objections.

I do not sell your data. I do not use it for anyone else's marketing.

Do you have to give me your details?

To place an order and receive the work, yes: I need a contact name, a work email and the intake information. Everything else is optional.

Who processes it for me

• Spaceship and Cloudflare (domain email routing): route email sent to my public address, hello@aisavingscheck.com, and forward it to the private operational mailbox I use to run the business. Emails and attachments are received, sent and stored in that mailbox under its provider's own terms and published safeguards.

• Stripe: processes payments, receipts and invoices. Stripe also acts as a separate controller for some of its own purposes, such as fraud prevention and legal duties, under its own privacy policy.

• Tally BV (Belgium): runs my enquiry and intake form, and stores form data in the European Union. If you upload files to the form, Tally stores them using its storage provider. Tally emails me an alert for each new submission.

• Cloudflare: hosts these websites (Cloudflare Pages). Cloudflare processes technical data such as IP addresses to serve and secure the pages, under its own terms.

• Call services: calls run on Google Meet or Microsoft Teams (or by phone, if we agree), as named in the invitation, under that provider's own terms and data protection commitments. If your organisation sends the invitation, your organisation's provider applies.

• Grok Bot: an assistant service whose assistants help me read and organise orders, intake material and emails, draft documents and replies, and keep my order records. I review and sign off every deliverable and every email I send personally. Order confirmation emails, and delivery emails for my digital template kits, are sent automatically, using only email templates and files I have approved.

Tally and Stripe act on my instructions under their data processing terms, except where Stripe acts as a separate controller as described above. Spaceship, Cloudflare, my mailbox provider, Google and Microsoft Teams provide their services under their own terms and data protection commitments. I don't use your documents to train models, and I will tell customers before adding a new provider that would process their material.

WhatsApp. If you message me on WhatsApp (+44 7858 286241), your messages and phone number are handled by WhatsApp (WhatsApp Ireland Limited and Meta) under WhatsApp's own terms and privacy policy. I use them only to reply to you, and I keep business messages for as long as I keep other customer correspondence.

Website assistant

If you use Nalia, the AI assistant on my websites, what you type or say is processed to answer you, on the basis of my legitimate interest in answering visitors' questions (UK GDPR Article 6(1)(f) and, where it applies, EU GDPR Article 6(1)(f)). Cloudflare (Workers AI) processes your messages to generate replies and does not keep them after replying. I do not store chat transcripts. Your chat history is saved only in your own browser (local storage) so that the conversation continues while you use the site; you can delete it at any time with the 'Clear chat' button or by clearing your browser data. I do not use the chat for analytics or advertising. Please do not enter the names of colleagues, confidential information or sensitive details. The assistant makes no decisions about you.

Voice. If you choose to speak to the assistant, the microphone only switches on when you press the microphone button. Your browser's own speech service turns your speech into text under its own terms; in Chrome this is usually Google, and in Edge usually Microsoft, and their servers may be outside the UK. Spoken replies are produced by your browser on your device.

Automated decisions

No decision about you is made solely by automated means. AI tools help me research, draft and check work. I review everything myself, and none of it has a legal or similarly significant effect on you.

International transfers

• My email routing and mailbox providers may process email in the United States and elsewhere, under their own published safeguards.

• Stripe may process payment data in the United States and elsewhere, under its own published safeguards.

• Tally stores form data in the European Union. Some of its service providers, such as the service that sends its email alerts, are in the United States and are covered by Tally's own safeguards.

• Cloudflare may process technical website data and website assistant messages in the United States and elsewhere, under its own published safeguards.

• WhatsApp/Meta may transfer data to the United States under the EU-US Data Privacy Framework and its UK Extension, or standard contractual clauses.

• Google and Microsoft may process call data in the United States and elsewhere, under their own published safeguards.

• Grok Bot may process data outside the UK.

You can ask me for details of the safeguards that apply to any of these transfers.

How long I keep it

• Orders, invoices, payment and refund records, and our contract emails: 6 years after the work ends, for legal, tax and accounting reasons.

• Intake documents and files you send for a review: deleted 90 days after delivery. I keep the final deliverable with the order record.

• If you opt out: I keep only your email address on my do-not-contact list, indefinitely, so that I never contact you again.

Your rights

You have rights of access, correction, erasure, restriction and objection. Where I rely on our contract and you gave me the details, you also have the right to data portability. Email hello@aisavingscheck.com. I reply within one month. There is no charge.

Children

My services are for adults in professional roles. I do not knowingly collect details from anyone under 18.

Complaints

Please contact me first so I can put it right. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113.

If you are in the European Union or EEA

Where EU data protection law applies to my use of your details, it applies alongside UK law, and you have the rights described above. I am based in the United Kingdom. I have not appointed a representative in the EU, because my processing of the details of people in the EU is occasional, does not include special category data and is unlikely to put your rights at risk (EU GDPR Article 27(2)). You can complain to the data protection authority in the EU or EEA country where you live or work. Details sent from the EU or EEA to me in the UK are covered by the European Commission's adequacy decision for the United Kingdom.

Changes to this notice

The date at the top shows when this notice last changed. If I make a significant change, I will tell customers before relying on it.